Skip to content

GitLab

T
tangled
Commit caad6924 authored by K Moon's avatar K Moon Committed by Commit Bot
Browse files
Options

Add minimal test for PDF viewer scripting and opaque origins 

This change adds a test that verifies the current behavior: When the PDF
viewer tries to send a scripting message to an opaque origin (such as a
"data:" URL), the postMessage() fails with a SyntaxError.

We may want to make this case work, in which case, simply change the
expected result of this test from "blocked" (false) to "allowed" (true).

This leverages the existing TestGetSelectedTextReply() test (used to
test same-origin and cross-origin requests). The existing test doesn't
behave correctly if PDFViewer.sendScriptingMessage_() throws, so I've
moved the postMessage("flush") call into a finally block to fix that.

Bug: 1004425
Change-Id: I28ad56a21f634f42e20e3ca76fa4a02151b2560a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1808580Reviewed-by: default avatarLei Zhang <thestig@chromium.org>
Commit-Queue: K Moon <kmoon@chromium.org>
Cr-Commit-Position: refs/heads/master@{#697305}
parent 194b246e
Hide whitespace changes
Inline Side-by-side
Showing with 28 additions and 3 deletions
chrome/browser/pdf/pdf_extension_test.cc
View file @ caad6924
......@@ -300,9 +300,12 @@ class PDFExtensionTest : public extensions::ExtensionApiTest {
"var oldSendScriptingMessage = "
" PDFViewer.prototype.sendScriptingMessage_;"
"PDFViewer.prototype.sendScriptingMessage_ = function(message) {"
" oldSendScriptingMessage.bind(this)(message);"
" if (message.type == 'getSelectedTextReply')"
" this.parentWindow_.postMessage('flush', '*');"
" try {"
" oldSendScriptingMessage.bind(this)(message);"
" } finally {"
" if (message.type == 'getSelectedTextReply')"
" this.parentWindow_.postMessage('flush', '*');"
" }"
"}"));
// Add an event listener for flush messages and request the selected text.
......@@ -756,6 +759,12 @@ IN_PROC_BROWSER_TEST_F(PDFExtensionTest, EnsureSameOriginRepliesAllowed) {
true);
}
// TODO(crbug.com/1004425): Should be allowed?
IN_PROC_BROWSER_TEST_F(PDFExtensionTest, EnsureOpaqueOriginRepliesBlocked) {
TestGetSelectedTextReply(
embedded_test_server()->GetURL("/pdf/data_url_rectangles.html"), false);
}
// Ensure that the PDF component extension cannot be loaded directly.
IN_PROC_BROWSER_TEST_F(PDFExtensionTest, BlockDirectAccess) {
WebContents* web_contents = GetActiveWebContents();
......
chrome/test/data/pdf/data_url_rectangles.html 0 → 100644
View file @ caad6924
<!doctype html>
<meta charset="utf-8">
<title>data: of //pdf/test/data/rectangles.pdf</title>
<embed type="application/pdf" width="640" height="480"
src="data:application/pdf;base64,
JVBERi0xLjcKJaDypPQKMSAwIG9iaiA8PAogIC9UeXBlIC9DYXRhbG9nCiAgL1BhZ2VzIDIgMCBS
Cj4+CmVuZG9iagoyIDAgb2JqIDw8CiAgL1R5cGUgL1BhZ2VzCiAgL01lZGlhQm94IFsgMCAwIDIw
MCAzMDAgXQogIC9Db3VudCAxCiAgL0tpZHMgWyAzIDAgUiBdCj4+CmVuZG9iagozIDAgb2JqIDw8
CiAgL1R5cGUgL1BhZ2UKICAvUGFyZW50IDIgMCBSCiAgL0NvbnRlbnRzIDQgMCBSCj4+CmVuZG9i
ago0IDAgb2JqIDw8Cj4+CnN0cmVhbQpxCjAgMCAwIHJnCjAgMjkwIDEwIDEwIHJlIEIqCjEwIDE1
MCA1MCAzMCByZSBCKgowIDAgMSByZwoxOTAgMjkwIDEwIDEwIHJlIEIqCjcwIDIzMiA1MCAzMCBy
ZSBCKgowIDEgMCByZwoxOTAgMCAxMCAxMCByZSBCKgoxMzAgMTUwIDUwIDMwIHJlIEIqCjEgMCAw
IHJnCjAgMCAxMCAxMCByZSBCKgo3MCA2NyA1MCAzMCByZSBCKgpRCmVuZHN0cmVhbQplbmRvYmoK
eHJlZgowIDUKMDAwMDAwMDAwMCA2NTUzNSBmIAowMDAwMDAwMDE1IDAwMDAwIG4gCjAwMDAwMDAw
NjggMDAwMDAgbiAKMDAwMDAwMDE2MSAwMDAwMCBuIAowMDAwMDAwMjMwIDAwMDAwIG4gCnRyYWls
ZXI8PCAvUm9vdCAxIDAgUiAvU2l6ZSA1ID4+CnN0YXJ0eHJlZgo0NTYKJSVFT0YK">
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment